HEX
Server: Apache/2.4.46 (Win64) OpenSSL/1.1.1j PHP/8.4.25
System: Windows NT DESKTOP-4TAV2RJ 10.0 build 19045 (Windows 10) AMD64
User: fred (0)
PHP: 8.4.25
Disabled: NONE
Upload Files
File: C:/Windows/System32/zh-TW/wecutil.exe.mui
MZ����@���	�!�L�!This program cannot be run in DOS mode.

$5�<�q�R�q�R�q�R�e���p�R�e�P�p�R�Richq�R�PEL�!z

��#@ �w8.rdata�@@.rsrc� x@@�}��
T88�}��$��8.rdata8x.rdata$zzzdbg �.rsrc$01� ��.rsrc$02 h�1��N�|'����KI���"��5��}����(�@�X�p��������� ���!�r�(���MUI�������DQ14�Ʀ���"�Ȥ-'�6��4½�w����MUIzh-TW9��aԚ
N��0%0

,!q�l��_U8��Q�j: %1!s!0%0

,!q�l��_U-��[�j: %1!s!0%0

 
Nck�x�v-��[�j0%0

 !q�l�_-��[�j���S0%0

$!q�lR�YS COM0%0

,!q�l�_-��[�j���S���X�%R�x0%0

!q�l��_U���0%0

!q�l2QX[���0%0

��]�)R2QX[����FO�vMR!q�l_U(u0ˊO(u retry-subscription }T�N�O͑f����0

�Y�g���ck(W�WL�-N��`_N�S�NO(u get-subscriptionruntimestatus }T�N�O

�S�_�^8O/����rKa0

!q�l*Rd����0%0

 !q�l��_U���R	�0%0

!q�lR	����0%0

,!q�l�S�_ %1!s! gQ�[0%0

,!q�l-��[ %1!s! gQ�[0%0

0!q�l͑f��N�N�O�n: %1!s!0%0

!q�l͑f����0%0


N/e�cdk<h_0%0

(
Nck�x�v�P^�!j_ %d0%0

(
Nck�x�vgQ�[<h_ %d0%0

@
Nck�x�vgQ�[<P '%1!s!' (%2!s!)0%0

(
N/e�c}T�N %1!s!0%0

8
Nck�x�vx�� %1!s!0*gc�[x��
T1z0%0

D
Nck�x�vx�� %1!s!0x���]�}��c�[N�N!k�N
N0%0

8
Nck�x�vx�� %1!s!0x��
N/ftexe0%0

8
Nck�x�vx�� %1!s!0*gc�[x��<P0%0

8
Nck�x�vx�� %1!s!0x��
N/f^�g<P0%0

8
Nck�x�vx�� %1!s!0
N/e�cdkx��0%0

c�[*YY_xe0%0

 *gc�[�_��_xe0%0

gQ�/���0%0

!q�l���S�[�x0%0

<*gc�[ EventSourceAddress0%0

*gc�[}T�N0%0

(~b
N0Rdk����v�N�N�O�n0%0

<-��[�j�v9h�{ޞ
N/f����bvQ}T
Tzz��
Nck�x0%0

4f�JT: �N�N�O�n %1!s! �]\P(u0%0

(��� %1!s! �]X[(W0%0

<�Y�g�N�N�O�n %1!s! �]X[(W�GR!q�l�e�X0%0

LWindows Event Collector lQ(uz_



�S���`�^�z��{t�_/e�c WS-Management �
�TS�[�v`��z�N�N�O�n@bI���OKN�N�N�v

���0



O(u�e_:



�`�S�NO(u�w (�Y�es, /f) bw� (�Y enum-subscription, /format) Hr,g�v

}T�N�Tx��
T1z0}T�N0x���Tx��<P
Ng@SR'Y\�[0



(hQ�W[�k'Y�[ = ��xe)



wecutil COMMAND [ARGUMENT [ARGUMENT] ...] [/OPTION:VALUE [/OPTION:VALUE] ...]



}T�N:



es (enum-subscription)               R�Q�sX[�v���0

gs (get-subscription)                �S�_���-��[0

gr (get-subscriptionruntimestatus)   �S�_����WL����k�rKa0

ss (set-subscription)                -��[���-��[0

cs (create-subscription)             �^�z�e���0

ds (delete-subscription)             *Rd����0

rs (retry-subscription)              ͑f����0

qc (quick-config)                    -��[ Windows Event Collector 
g�R0



8^(ux��:



/h|? (help)

�S�_ wecutil z_�vN,���f0



wecutil { -help | -h | -? }



傁��N�_xe�Tx���ˊ�S��yr�[}T�N�vO(u�e_:



wecutil COMMAND -?

l!�^�z`��z���0



O(u�e_:



wecutil { cs | create-subscription } CONFIGURATION_FILE [/OPTION:VALUE [/OPTION:VALUE] ...]



CONFIGURATION_FILE

c�[S+T���-��[�v XML �jHhKN_�vW[2N0dk_�S�N/f�vMR�v��vU}
\b�v
\_0







x��:



�`�SO(u�w (�Y /cun) bw� (�Y /CommonUserName) Hr,g�vx��
T1z0x���vQ<P
N

@SR'Y\�[0



/cun:USERNAME  (CommonUserName)

�p,g���l	gO(u���I��v�N�N�O�n-��[qQ(uO(u���I�0dkx���Si�(u�e6eƖhVw��Y

���0�la: �Y�gc�[dkx���GRg�_eu-��[�j-NP%R�N�N�O�n�v

UserName/UserPassword -��[0��`ݑ
\yr�[�N�N�O�nO(u
NT�v��I��ˊݑ
\r��N

�N�O�nO(u ss (set-subscription) }T�N�O-��[0



/cup:PASSWORD  (CommonUserPassword)

-��[qQ(uO(u���I��vO(u��[�x0vu PASSWORD -��p * (f_�) Bf�g�_;N�c�S��

�Sr��[�x0dkx���P(Wc�[ /cun (CommonUserName) x��BfMb	gHe0









�{�O:



�^�z6eƖhVw��Y����\�N�N�_`��z��f� mySource.myDomain.com �v�a(uz_�N�N

���jI��0R ForwardedEvents ���j0



wecutil cs ci_subscription.xml



ci_subscription.xml �vgQ�[:



<Subscription xmlns="http://schemas.microsoft.com/2006/03/windows/events/subscription">

    <SubscriptionId>SampleCISubscription</SubscriptionId>

    <SubscriptionType>CollectorInitiated</SubscriptionType>

    <Description>Collector Initiated Subscription Sample</Description>

    <Enabled>true</Enabled>

    <Uri>http://schemas.microsoft.com/wbem/wsman/1/windows/EventLog</Uri>



    <!-- Use Normal (default), Custom, MinLatency, MinBandwidth -->

    <ConfigurationMode>Custom</ConfigurationMode>



    <Delivery Mode="Push">

        <Batching>

            <MaxItems>20</MaxItems>

            <MaxLatencyTime>60000</MaxLatencyTime>

        </Batching>

        <PushSettings>

            <HostName>thisMachine.myDomain.com</HostName>

            <Heartbeat Interval="60000"/>

        </PushSettings>

    </Delivery>



    <Expires>2010-01-01T00:00:00.000Z</Expires>



    <Query>

        <![CDATA[

            <QueryList>

                <Query Path="Application">

                    <Select>*</Select>

                </Query>

            </QueryList>

        ]]>

    </Query>

    <ReadExistingEvents>false</ReadExistingEvents>

    <TransportName>http</TransportName>

    <ContentFormat>RenderedText</ContentFormat>

    <Locale Language="en-US"/>

    <LogFile>ForwardedEvents</LogFile>

    <CredentialsType>Default</CredentialsType>



    <EventSources>

        <EventSource Enabled="true">

            <Address>mySource.myDomain.com</Address>

            <UserName>myUserName</UserName>

        </EventSource>

    </EventSources>

</Subscription>











�{�O:



�^�z�O�nw��Y�v����\�N�N�_`��z��f� mySource.myDomain.com �v�a(uz_�N�N

���jI��0R ForwardedEvents ���j0



wecutil cs si_subscription.xml



si_subscription.xml �vgQ�[:



<Subscription xmlns="http://schemas.microsoft.com/2006/03/windows/events/subscription">

    <SubscriptionId>SampleSISubscription</SubscriptionId>

    <SubscriptionType>SourceInitiated</SubscriptionType>

    <Description>Source Initiated Subscription Sample</Description>

    <Enabled>true</Enabled>

    <Uri>http://schemas.microsoft.com/wbem/wsman/1/windows/EventLog</Uri>



    <!-- Use Normal (default), Custom, MinLatency, MinBandwidth -->

    <ConfigurationMode>Custom</ConfigurationMode>



    <Delivery Mode="Push">

        <Batching>

            <MaxItems>1</MaxItems>

            <MaxLatencyTime>1000</MaxLatencyTime>

        </Batching>

        <PushSettings>

            <Heartbeat Interval="60000"/>

        </PushSettings>

    </Delivery>



    <Expires>2018-01-01T00:00:00.000Z</Expires>



    <Query>

        <![CDATA[

            <QueryList>

                <Query Path="Application">

                    <Select>Event[System/EventID='999']</Select>

                </Query>

            </QueryList>

        ]]>

    </Query>



    <ReadExistingEvents>true</ReadExistingEvents>

    <TransportName>http</TransportName>

    <ContentFormat>RenderedText</ContentFormat>

    <Locale Language="en-US"/>

    <LogFile>ForwardedEvents</LogFile>

    <AllowedSourceNonDomainComputers></AllowedSourceNonDomainComputers>

    <AllowedSourceDomainComputers>O:NSG:NSD:(A;;GA;;;DC)(A;;GA;;;NS)</AllowedSourceDomainComputers>

</Subscription>



ˊ�la�vu�^�z�O�nw��Y�v���Bf��Y�g AllowedSourceDomainComputers0

AllowedSourceNonDomainComputers/AllowedIssuerCAList0

AllowedSubjectList �N�S DeniedSubjectList ��/fzz�v�GR�-�g�c�O

AllowedSourceDomainComputers - O:NSG:NSD:(A;;GA;;;DC)(A;;GA;;;NS)0

dk SDDL �-�<Pg\_|vdk����N�N�v�R���c� Domain Computers �}�W�D}b�T�

�N�S,g_j Network Service �D} (ݑ
\,g_jI��[�z)0



�R�Q@b	g�sX[�v`��z�N�N����v
T1z0



O(u�e_:



wecutil { es | enum-subscription }



�{�O:



R�Q�N�N���0



wecutil es

�o�:y`��z����v-��[nj
�0



O(u�e_:



wecutil { gs | get-subscription } SUBSCRIPTION_ID [/OPTION:VALUE [/OPTION:VALUE] ...]



SUBSCRIPTION_ID

/UNX�%R����vW[2N�1u(u�O�^�z����v XML -��[�j�v<SubscriptionId> j�@bc�[



x��:



�`�S�NO(u�w (�Y /f) bw� (�Y /format) Hr,g�vx��
T1z0x���vQ<P
N@SR'Y\

�[0



/f:VALUE (format)

VALUE �S�N/f XML b Terse0�Y�g VALUE �p XML�GRg�N XML <h_RpS8��Q0�Y�g

VALUE �p Terse (�-�)�GRg\<PRpS�p
T1z<PD}0



/u:VALUE (unicode)

o�:y Unicode <h_8��Q (UTF-16)0VALUE �S�N/f true b false0�Y�g VALUE �p

true�GR�N Unicode <h_8��Q0



�{�O:



8��Q
T�p sub1 ����v-��[nj
�0

wecutil gs sub1



8��Q�{�O:



Subscription Id: sub1

SubscriptionType: CollectorInitiated

Description: Push Collector Initiated Subscription

Enabled: true

Uri: http://schemas.microsoft.com/wbem/wsman/1/windows/EventLog

ConfigurationMode: Custom

DeliveryMode: Push

DeliveryMaxItems: 1

DeliveryMaxLatencyTime: 1000

HostName: thisMachine.myDomain.com

HeartbeatInterval: 60000

Expires: 2010-01-01T00:00:00.000Z

Query:

            <QueryList>

                <Query Path="Application">

                    <Select>*</Select>

                </Query>

            </QueryList>



ReadExistingEvents: true

TransportName: http

ContentFormat: RenderedText

Locale: en-US

LogFile: ForwardedEvents

CredentialsType: Default

CommonUserName: Administrator

CommonUserPassword: *



EventSource[0]:

    Address: mySource.myDomain.com

    Enabled: true

    UserName: myUserName

    UserPassword: *



EventSource[1]:

    Address: mySource1.myDomain.com

    Enabled: true

    UserName: myUserName

    UserPassword: *



�o�:y����WL����k�rKa0



O(u�e_:



wecutil { gr | get-subscriptionruntimestatus } SUBSCRIPTION_ID

 [EVENT_SOURCE [EVENT_SOURCE] ...]



SUBSCRIPTION_ID

/UNX�%R����vW[2N�1u(u�O�^�z����v XML -��[�j�v <SubscriptionId> j�c�[



EVENT_SOURCE

/UNX�%Rvu\O�N�N�O�nKN��f��vW[2N (O(u�[te�}�W
T1z0NetBIOS 
T1zb IP MO@W)0



�{�O:



o�:y
T�p sub1 ����v�WL����k�rKa0

wecutil gr sub1





Subscription: sub1

    RunTimeStatus: Active

    LastError: 0    ErrorMessage:

    ErrorTime: 2007-01-01T12:00:00.000

    NextRetryTime:

    LastHeartbeatTime:

    EventSources:

        MYSOURCE$

            RunTimeStatus: Active

            LastError: 0

            ErrorMessage:

            ErrorTime:

            NextRetryTime:

            LastHeartbeatTime: 2007-01-01T12:15:00.000



�*Rd�yr�[����&N�S�m���\�N�N�P^�0Rr�����v�N�N���j�v@b	g�N�N�O�n0
Ng

*Rd��NUO�]6e0R�T���v�N�N0



O(u�e_:



wecutil { ds | delete-subscription } SUBSCRIPTION_ID



SUBSCRIPTION_ID

/UNX�%R����vW[2N�1u(u�O�^�z����v XML -��[�j�v <SubscriptionId> j�

c�[



�{�O:



*Rd�
T�p sub1 �v���0

wecutil ds sub1

��^�z#��}&N�P�`��z�����Bl��OVf�͑�e_U�R@b	gbc�[�v�N�N�O�n��N͑f�^�O

(u-N�v���0

\P(u�v�O�n
Ng͑f�0



O(u�e_:



wecutil { rs | retry-subscription } SUBSCRIPTION_ID

 [EVENT_SOURCE [EVENT_SOURCE] ...]



SUBSCRIPTION_ID

/UNX�%R����vW[2N�1u(u�O�^�z����v XML -��[�j�v <SubscriptionId> j�

c�[



EVENT_SOURCE

/UNX�%Rvu\O�N�N�O�nKN��f��vW[2N (O(u�[te�}�W
T1z0NetBIOS 
T1zb

IP MO@W)0



�{�O:



͑f����
T1z�p sub1 �v@b	g�O�n0

wecutil rs sub1

��_}T�NR���f����SxebO(u XML -��[�j�

�N-��[���-��[0



O(u�e_:



wecutil { ss | set-subscription } SUBSCRIPTION_ID [/OPTION:VALUE [/OPTION:VALUE] ...]



wecutil { ss | set-subscription } /c:CONFIG_FILE [/cus:USERNAME [/cup:PASSWORD] ...]



SUBSCRIPTION_ID

/UNX�%R����vW[2N�1u(u�e�^�z����v XML -��[�j�v <SubscriptionId> 

j�@bc�[



x��:



�`�SO(u�w (sS /q) bw� (sS /Query) Hr,g�vx��
T1z0

x���vQ<P
N@SR'Y\�[0











8^(ux�� (i�(u�e@b	g^��W�v���):



/c:CONFIG_FILE    (Config)

dkW[2Nc�[S+T���-��[KN XML �jHh�v_0dk_�S�N/f

�vMR�v��vU}
\b�v
\_0dkx���S���x�(u�v

 /cus (CommonUserName) � /cup (CommonUserPassword) 

x��-dM�O(u�
N���@b	gvQ�Nx��TBfX[(W0



/e[:VALUE] (enabled)

_U(ub\P(u���0VALUE �S�N/f true b false0

dkx���v�-�<P�p true0



/d:DESCRIPTION    (Description)

�c�����vW[2N0



/ex:DATE_TIME    (Expires)

c�[���0RgBf���vW[2N0DATE_TIME <P/f�Nj�n XML b ISO8601 

�egBf��<h_c�[: yyyy-MM-ddThh:mm:ss[.sss][Z]�

vQ-N T /fBf��R��W[CQ�� Z /fc UTC Bf��0



/uri:URI

c�[���O(uKN�N�N^��W�vW[2N0

�N�N�O�n��f��vMO@W� URI 

�S/UNX�%R�N�N�O�n0



/cm:CONFIGURATION_MODE  (ConfigurationMode)

c�[-��[!j_�vW[2N0CONFIGURATION_MODE �S�N/fNRvQ-NNPW[2N: 

Normal0Custom0MinLatency b MinBandwidth0Normal0MinLatency 

�N�S MinBandwidth !j_�S-��[�P^�!j_0g'Y�P^���v0;m�R
�_�����

�N�Sg'Y�P^��^r�Bf��0�S	g(W-��[!j_-��p Custom Bf�Mb��c�[ 

/dm (DeliveryMode)0/dmi (DeliveryMaxItems)0/hi (HeartbeatInterval) 

b /dmlt (DeliveryMaxLatencyTime) x��0



/q:QUERY    (Query)

c�[���KN�gb�W[2N�vW[2N0dkW[2N�v<h_�O
NT�v URI <P�
NT�&NNi�(u�e���-N�v

@b	g�O�n0



/dia:DIALECT  (Dialect)

c�[�gb�W[2N@bO(u�e��vW[2N0



/cf:FORMAT   (ContentFormat)

c�[�P�V�N�N<h_�vW[2N0FORMAT �S�N/f Events b 

RenderedText0vu<P�p RenderedText Bf�g�ND��R�

r��N�N�v,g0WSW[2N (�Y�N�N�c�) �P�V�N�N0

FORMAT �v�-�<P�p RenderedText0



/l:LOCALE    (Locale)

c�[�N RenderedText <h_�P^�,g0WSW[2NKN0W@S-��[�vW[2N0LOCALE /f���/W�[

(0W@S) �eSX�%R�x��O�Y "en-US"0dkx���S	g(W /cf (ContentFormat) x��-��p

"RenderedText" BfMb	gHe0



/ree[:VALUE]   (ReadExistingEvents)

c�[���p����P^��v�N�N0VALUE �S�N/f true b false0

vu VALUE �p true Bf�g�_����N�N�O�n���S@b	g�sX[�N�N0

vu VALUE �p false Bf��Sg�P^�*g�O (�bT�) �N�N0

� /ree x���l	g<P��-�<P�p true0

�*gc�[ /ree x����-�<P�p false0



/lf:FILENAME   (LogFile)

dkW[2Nc�[(u�e2QX[�_�N�N�O�n�c6eKN�N�N�v

,g_j�N�N���j0



/pn:PUBLISHER  (PublisherName)

c�[|vL��
T1z�vW[2N0��_�/f�d	gb/SeQ /lf (LogFile) x��

c�[KN���v|vL��0



/dm:MODE (DeliveryMode)

c�[�P^�!j_�vW[2N0�Y�g/f6eƖhVw��Y�v����GR MODE �S�N/f pull b push�

�Y�g/f�O�nw��Y�v����GR�S�S�N/f push0dkx���S	g(W /cm (ConfigurationMode) 

x��-��p Custom BfMb	gHe0



/dmi:NUMBER  (DeliveryMaxItems)

c�[yb!k�P^�g'Y��vxe�vxeW[0dkx���S	g(W /cm (ConfigurationMode) -��p

Custom BfMb	gHe0



/dmlt:MS (DeliveryMaxLatencyTime)

c�[�P^��N�Nyb!kKNg'Y�^r�<P�vxeW[0MS �p�k�yxe0

dkx���S	g(W /cm (ConfigurationMode) -��p 

Custom BfMb	gHe0



/hi:MS   (HeartbeatInterval)

c�[ push ���KN;m�R
�_�����b pull ����v*�b������vxeW[0

MS �p�k�yxe0dkx���S	g(W /cm (ConfigurationMode) -��p 

Custom BfMb	gHe0



/tn:TRANSPORTNAME   (TransportName)

c�[(u�e#��}�`��z�N�N�O�nKN�P8�
T1z�vW[2N0

�S�N/f http b https0

h/esa:EVENT_SOURCE   (EventSourceAddress)

c�[�N�N�O�n�vMO@W0EVENT_SOURCE /fX�%Rvu\O�N�N�O�nKN��f��vW[2N (O(u�[te�}

�W
T1z0NetBIOS 
T1zb IP MO@W)0dkx���a� /ese (EventSourceEnabled)0

/aes (AddEventSource)0/res (RemoveEventSource) b /un (UserName) 

� /up (UserPassword) x��-dM�O(u0



/ese[:VALUE]  (EventSourceEnabled)

_U(ub\P(u�N�N�O�n0VALUE �S�N/f true b false0�S	g(Wc�[

/esa (EventSourceAddress) x��Bf�MbAQ1�dkx��0dkx���v�-�<P�p true0



6eƖhVw��Y���yr	g�vx��:



/aes  (AddEventSource)

�e�X /esa (EventSourceAddress) x��c�[�v�N�N�O�n (�vQ��
N/f����vN�

R)0� /esa (EventSourceAddress) c�[�vMO@W�]/f����vN�R�GRg|vu/�

��0�S	g(Wc�[ /esa (EventSourceAddress) x��Bf�MbAQ1�dkx��0



/res  (RemoveEventSource)

�yd� /esa (EventSourceAddress) x��c�[�v�N�N�O�n (�vQ�]/f����vN�

R)0� /esa (EventSourceAddress) c�[�vMO@W
N/f����vN�R�GRg|vu

/���0�S	g(Wc�[ /esa (EventSourceAddress) x��Bf�MbAQ1�dkx��0



/un:USERNAME   (UserName)

c�[��� /esa (EventSourceAddress) x��c�[�v�O�n-dM�O(u�vO(u���I�0

�S	g(Wc�[ /esa (EventSourceAddress) x��Bf�MbAQ1�dkx��0



/up:PASSWORD   (UserPassword)

�p /esa (EventSourceAddress) x��@bc�[�O�n�vO(u���I�-��[O(u��[�x0

�S	g(Wc�[ /un (UserName) x��Bf�MbAQ1�dkx��0



/tp:TRANSPORTPORT   (TransportPort)

#��}�`��z�N�N�O�nBf��P8�@bO(u�v#��c�W_��x0�*gc�[�GR#��c�W�-��p(u�ec

�[�P8�
T1z�vj�n#��c�W: 80 (i�(u http)0443 (i�(u https)



/hn:NAME   (HostName)

c�[,g_j��f� FQDNS 
T1z�vW[2N0`��z�N�N�O�nO(udk
T1z�O�c�V�N�N��N�Pi�(u

�e�c����0�[/f(WS+T�S��	gYP FQDNS 
T1z�vY͑;N�v�:O
ghV�v�`�lNO(u0



/ct:TYPE   (CredentialsType)

dkW[2Nc�[(u�e`��z�O�nX[�S�v��I�^��W0TYPE �S�N/fNRvQ-NNP<P: 

"default"0"negotiate"0"digest"0"basic" b "localmachine"0�-�<P

�p "default"0



/cun:USERNAME   (CommonUserName)

�p,g���l	gO(u���I��v�N�N�O�n-��[qQ(uO(u���I�0�la: �TBfc�[dkx���

/c (Config) x���GRg�_eu-��[�j-NP%R�N�N�O�n�v UserName/UserPassword 

-��[0��`ݑ
\yr�[�N�N�O�nO(u
NT�v��I��GR�S(WvQ�N ss (set-subscription) 

}T�N�v}T�NR-N��pyr�[�N�N�O�nc�[ /un (UserName) � 

/up (UserPassword)��N���[dk<P0



/cup:PASSWORD   (CommonUserPassword)

-��[qQ(uO(u���I��vO(u��[�x0vu PASSWORD -��p * (f_�) Bf�g�_;N�c�S��

�S�[�x0�S	g(Wc�[ /cun (CommonUserName) x��Bf�dkx��Mb	gHe0











�O�nw��Y���yr	g�vx��:



/ica:THUMBPRINTS   (AllowedIssuerCA)

-��[=||v��aI�c}�vn�U��n�U<h_/f�N�_�����0



/as:SUBJECTS   (AllowedSubjects)

�N�_������vW[2Nn�U�c�[AQ1�w��Y���KN^��}�W��f��v DNS 
T1z0dk
T1z�S�NO

(u,�(uW[CQc�[ (�Y "*.mydomain.com")0dkn�U�-�/fzz�v0



/ds:SUBJECTS   (DeniedSubjects)

�N�_������vW[2Nn�U�c�[
NAQ1�w��Y���KN^��}�W��f��v DNS 
T1z0dk
T1z�S�N

O(u,�(uW[CQc�[ (�Y "*.mydomain.com")0dkn�U�-�/fzz�v0



/adc:SDDL   (AllowedSourceDomainComputers)

dkW[2Nc�[/f&TAQ1��}�W��f�w��Y��� (<h_�p SDDL)0�-�/fAQ1�@b	g�}�W��f�w��Y

���0











�{�O:



�_�e�v XML �jHh WsSelRg2.xml �f�e
T�p sub1 �v���-��[0

wecutil ss sub1 /c:%Windir%\system32\WsSelRg2.xml



O(uYP�Sxe�O�f�e
T�p sub2 �v���-��[:

wecutil ss sub2 /esa:myComputer /ese /un:uname /up:* /cm:Normal



�f�e�O�nw��Y����vAQ1���bU};N�en�U:

wecutil ss sub3 /as:"*.private.mydomain.com" /ds:"*.public.mydomain.net,*.mydomain.tv"



|-��[ Windows Event Collector 
g�R��x�[(W͑�e_U�Rg����� Y�^�z�S�}c���0

dk\OmiS�bNRek_�:

  1. � ForwardedEvents �S��]\P(u�GR�N�N_U(u0

  2. -��[ Windows Event Collector 
g�R�N�^r�_U�R (�PP� Vista ��f�eHr,g)0

  3. � Windows Event Collector 
g�R&N*g�WL��GR�N�N_U�R0



O(u�e_:



wecutil { qc | quick-config } [/OPTION:VALUE]



x��:



�`�S�NO(u�w (�Y /q) bw� (�Y /quiet) Hr,g�vx��
T1z0x���vQ<P
N@SR'Y\

�[0



/q[:VALUE] (Quiet)

VALUE �S�N/f true b false0傺p true�quick-config 
Ngo�:y�c:y��Bl�`�x��0

dkx���v�-�<P�p false0



�{�O:



wecutil qc

`!q�li�vu0W-��[ Windows Event Collector 
g�R0ˊ
z�_�Qf�0%0

(8�eQ %1!s! �v�[�x:%0

xf�JT: ����v-��[!j_
N/f Custom0�.z!j_!q�l���P^�gQ�[0�Vdk�\�_eu�c�O

�v-��[�j-N�v�P^��{ޞ0

H����v-��[!j_
N/f0��
00!q�l�pdk!j_-��[gQ�[ %1!s!0

\
g�R_U�R!j_\���f�p0�^r�_U�R
00�`��|~�~�U ( %c- /fb %c- &T)?%0

Y%0

N%0

L�]�)R-��[ Windows Event Collector 
g�R0

�4VS_VERSION_INFO��
aJ
aJ?�StringFileInfo�040404B0LCompanyNameMicrosoft CorporationXFileDescriptionEvent Collector }T�NRlQ(uz_h$FileVersion10.0.19041.1 (WinBuild.160101.0800)8InternalNameWECUTIL.EXE�.LegalCopyright� Microsoft Corporation. All rights reserved.HOriginalFilenameWECUTIL.EXE.MUIj%ProductNameMicrosoft� Windows� Operating System>
ProductVersion10.0.19041.1DVarFileInfo$Translation�PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADD